Logic Software Solutions

About the Role
Loghic Hire is seeking a senior, hands-on architect to lead the containerization of a large-scale API estate for an enterprise financial services client and turn an approved AWS EKS reference architecture into a secure, repeatable production platform.
This is an&nbsp;architect-who-builds&nbsp;role: you will write and review Terraform, Helm, Kustomize, Flux, and Istio policy, and stay close enough to the code, pipelines, and operational data to prove the platform works. Application images stay stateless and portable; the platform owns transport security, identity, routing, secrets, telemetry, admission policy, and rate limiting.
You will operate at the intersection of&nbsp;architecture, hands-on engineering, and technical leadership&nbsp;— defining the target state, then building it, documenting it, and proving it in production. Expect to move fluidly between whiteboarding an ADR, reviewing a Terraform module, debugging an Istio waypoint, and coaching an SRE through a canary rollout.
Key Responsibilities1. EKS Platform Foundation &amp; Golden Path
<ul>
<li>
Design, build, and operate a&nbsp;repeatable, multi-AZ Amazon EKS Auto Mode foundation&nbsp;that serves as the golden path for all application teams.
</li>
<li>
Implement and harden core cluster add-ons:&nbsp;VPC CNI, Karpenter&nbsp;(node provisioning and scaling),&nbsp;KEDA&nbsp;(event-driven autoscaling), CoreDNS, and metrics-server.
</li>
<li>
Author&nbsp;reusable Terraform modules, Helm charts, and Kustomize overlays&nbsp;that encode platform standards and can be consumed self-service by application teams.
</li>
<li>
Establish&nbsp;cluster lifecycle management: version upgrades, node rotation, add-on upgrades, and disaster recovery — with documented runbooks.
</li>
<li>
Define&nbsp;multi-tenancy boundaries&nbsp;(namespaces, quotas, resource limits, RBAC) and enforce them through policy.
</li>
<li>
Ensure the platform is&nbsp;fully documented and operable by SRE, including on-call runbooks, dashboards, and escalation paths.
</li>
<li>
Define and publish&nbsp;golden path templates&nbsp;so new services can be onboarded in hours, not weeks.
</li>
</ul>
2. GitOps Delivery &amp; Continuous Reconciliation
<ul>
<li>
Make&nbsp;Flux the sole production deployment path&nbsp;— no ClickOps, no manual kubectl applies, no out-of-band changes.
</li>
<li>
Implement&nbsp;continuous reconciliation&nbsp;across all clusters, with drift detection, alerting, and automated remediation.
</li>
<li>
Integrate&nbsp;GitLab CI and Artifactory&nbsp;into the build-and-promote pipeline; enforce&nbsp;signed, digest-pinned images&nbsp;end to end.
</li>
<li>
Build&nbsp;environment promotion workflows&nbsp;(dev → staging → prod) with policy gates and approval controls.
</li>
<li>
Implement&nbsp;Flagger SLO-gated canary deployments, including metric analysis, automatic rollback, and progressive traffic shifting.
</li>
<li>
Own the&nbsp;GitOps repository structure, branching model, and secrets-handling strategy (SOPS/Sealed Secrets/External Secrets).
</li>
<li>
Drive&nbsp;image automation&nbsp;for dependency and base-image updates where appropriate.
</li>
</ul>
3. Service Mesh — Istio Ambient
<ul>
<li>
Architect and operate&nbsp;Istio Ambient mode:&nbsp;istiod,&nbsp;istio-cni,&nbsp;ztunnel, and&nbsp;opt-in waypoints&nbsp;for L7 policy.
</li>
<li>
Implement&nbsp;SPIFFE workload identity&nbsp;and&nbsp;strict mTLS&nbsp;across all east-west traffic.
</li>
<li>
Author and enforce&nbsp;AuthorizationPolicy&nbsp;and&nbsp;default-deny NetworkPolicy&nbsp;for zero-trust segmentation.
</li>
<li>
Define&nbsp;waypoint placement strategy&nbsp;— when to use L4 ztunnel vs. L7 waypoint — and document the trade-offs.
</li>
<li>
Measure and report mesh latency and overhead; validate the ambient model meets performance budgets.
</li>
<li>
Own mesh&nbsp;upgrade strategy, version skew policy, and troubleshooting playbooks.
</li>
<li>
Provide mesh&nbsp;self-service patterns&nbsp;so application teams can declare their own policies safely.
</li>
</ul>
4. API Gateway &amp; API Containerization
<ul>
<li>
Deliver a&nbsp;single governed north-south ingress&nbsp;using&nbsp;Tyk Self-Managed, fully&nbsp;Operator-driven from Git.
</li>
<li>
Implement&nbsp;authentication, authorization, rate limiting, quotas, routing, and API versioning&nbsp;at the gateway.
</li>
<li>
Enable&nbsp;REST-to-gRPC transcoding&nbsp;so legacy REST consumers can reach modern gRPC services transparently.
</li>
<li>
Lead the&nbsp;migration of existing APIs&nbsp;onto the platform — inventory, prioritization, cutover planning, and rollback strategy.
</li>
<li>
Define&nbsp;API onboarding standards&nbsp;and self-service workflows for application teams.
</li>
<li>
Own&nbsp;gateway observability, analytics (Tyk Pump), and policy lifecycle.
</li>
</ul>
5. Security, Compliance &amp; Audit
<ul>
<li>
Enforce&nbsp;Pod Security Standards (PSS)&nbsp;across all namespaces, with documented exceptions.
</li>
<li>
Implement&nbsp;Kyverno admission policy&nbsp;as code — validation, mutation, and generation rules managed via Git.
</li>
<li>
Configure&nbsp;EKS Pod Identity&nbsp;and least-privilege&nbsp;IAM&nbsp;roles for workloads and add-ons.
</li>
<li>
Integrate&nbsp;AWS Secrets Manager / CSI driver&nbsp;and&nbsp;KMS&nbsp;for secrets and encryption at rest.
</li>
<li>
Manage&nbsp;certificate lifecycle&nbsp;with&nbsp;cert-manager&nbsp;(issuance, rotation, revocation).
</li>
<li>
Implement&nbsp;image signing and SBOM generation, with admission-time verification.
</li>
<li>
Build a&nbsp;durable billing/audit capture path&nbsp;(Kinesis → Firehose → S3 Object Lock) with an&nbsp;approved, load-tested reliability contract.
</li>
<li>
Produce&nbsp;threat models&nbsp;and participate in security reviews with the client's risk and compliance teams.
</li>
<li>
Support&nbsp;PCI-scoped and SOC 2&nbsp;control objectives across the platform.
</li>
</ul>
6. API Contracts, Reliability &amp; Operations
<ul>
<li>
Establish&nbsp;gRPC/Protobuf as the east-west standard, with&nbsp;buf breaking-change checks&nbsp;enforced in CI.
</li>
<li>
Define&nbsp;SLOs and error budgets&nbsp;for platform services and the golden path; report on them regularly.
</li>
<li>
Instrument the platform with&nbsp;OpenTelemetry&nbsp;for&nbsp;metrics, logs, and traces&nbsp;— built in, not bolted on.
</li>
<li>
Build&nbsp;dashboards, alerts, and rollout analysis&nbsp;tooling for platform and application teams.
</li>
<li>
Drive&nbsp;performance validation at tens of thousands of TPS, including load testing and capacity planning.
</li>
<li>
Own&nbsp;incident response&nbsp;for the platform during build-out, including participation in the escalation rotation.
</li>
<li>
Continuously improve&nbsp;reliability, cost efficiency, and operational ergonomics.
</li>
</ul>
7. Technical Leadership &amp; Client Engagement
<ul>
<li>
Author and maintain&nbsp;Architecture Decision Records (ADRs), standards, and reference architectures.
</li>
<li>
Produce&nbsp;threat models&nbsp;and design reviews for critical platform components.
</li>
<li>
Coach and mentor&nbsp;platform engineers, SREs, and application engineers — raise the technical bar across teams.
</li>
<li>
Represent&nbsp;Loghic Hire&nbsp;in&nbsp;client architecture reviews, steering committees, and readiness assessments.
</li>
<li>
Collaborate with client stakeholders to align platform roadmap with business and regulatory priorities.
</li>
<li>
Contribute to&nbsp;internal Loghic Hire practice development&nbsp;— reusable patterns, playbooks, and accelerators.
</li>
</ul>
Tech StackCategoryTechnologiesCloud &amp; Container OrchestrationAWS, Amazon EKS (Auto Mode), EC2, VPC, IAM, KMS, Secrets Manager, EKS Pod Identity, Karpenter, KEDAInfrastructure as CodeTerraform, Helm, KustomizeGitOps &amp; CI/CDFlux, GitLab CI, Artifactory, Flagger, image automationService MeshIstio (Ambient mode), istiod, istio-cni, ztunnel, waypoints, SPIFFE, mTLS, AuthorizationPolicyAPI GatewayTyk Self-Managed, Tyk Operator, Tyk Pump, REST-to-gRPC transcodingNetworking &amp; PolicyVPC CNI, NetworkPolicy, Kyverno, Pod Security StandardsSecurity &amp; Compliancecert-manager, image signing, SBOMs, S3 Object Lock, PCI-scoped environments, SOC 2Event &amp; Audit CaptureAmazon Kinesis, Firehose, S3 Object LockAPI ContractsgRPC, Protobuf, buf, HTTP/2Runtime &amp; LanguagesJava 21, Spring Boot, Go (nice to have)ObservabilityOpenTelemetry, Prometheus/AMP, Grafana, Fluent Bit, Splunk, Honeycomb, SLOs/error budgetsCost &amp; OptimizationGraviton, Kubecost, OpenCostRequirements
<ul>
<li>
10+ years&nbsp;in software, infrastructure, or platform engineering, including&nbsp;5+ years of hands-on production Kubernetes on AWS&nbsp;— EKS architecture, operations, networking, upgrades, scaling, and incident troubleshooting.
</li>
<li>
Proven track record of standing up EKS platforms end to end and containerizing existing API workloads onto them at enterprise scale.
</li>
<li>
Strong IaC and Kubernetes configuration skills (Terraform, Helm, Kustomize) and reusable platform-module design, with defensible architecture decisions and cross-team leadership in a regulated environment.
</li>
<li>
Production service mesh ownership —&nbsp;Istio&nbsp;architecture, policy, rollout, performance, troubleshooting;&nbsp;Ambient mode&nbsp;especially relevant.
</li>
<li>
Deep&nbsp;GitOps&nbsp;experience with continuous reconciliation, drift management, and environment promotion; able to implement the target model in&nbsp;Flux.
</li>
<li>
Practical Kubernetes and AWS security:&nbsp;PSS, policy as code, NetworkPolicy, IAM, Pod Identity, KMS, certificate management, image signing, SBOMs.
</li>
<li>
API gateway and regulated audit/event-ingestion design; able to own a self-managed gateway (direct Tyk experience strongly preferred).
</li>
<li>
Working knowledge of&nbsp;gRPC, HTTP/2, and Protobuf, plus enough&nbsp;Java 21 / Spring Boot&nbsp;familiarity to review the reference runtime pattern.
</li>
<li>
Observability depth across metrics, logs, traces, SLOs, and rollout analysis with&nbsp;OpenTelemetry; performance validation at tens of thousands of TPS.
</li>
</ul>
Nice to Have
<ul>
<li>
Tyk Operator/Pump and custom Go or gRPC plugins
</li>
<li>
Flux image automation
</li>
<li>
Flagger progressive delivery
</li>
<li>
Kinesis/Firehose/S3 Object Lock compliance-grade event capture
</li>
<li>
Graviton, Kubecost/OpenCost and cloud-cost optimization
</li>
<li>
Fluent Bit, AMP, Splunk, Honeycomb, Grafana
</li>
<li>
PCI-scoped, SOC 2, or fintech platform engineering
</li>
<li>
AWS Solutions Architect Professional, CKA/CKS
</li>
</ul>
Other Requirements
<ul>
<li>
Remote within the&nbsp;US, California preferred for occasional client-site workshops and readiness reviews.
</li>
<li>
Requires&nbsp;US Pacific hours overlap, an&nbsp;escalation rotation during build-out, and&nbsp;client background screening.
</li>
</ul>